@knpkv/jira-cli 1.4.0 → 1.5.0

package/src/commands/auth.ts

@@ -1,172 +1,9 @@
 /**
- * Auth subcommands: create, configure, login, logout, status.
- *
- * **Mental model**
- *
- * - Each command is a standalone `Command.make` that yields into `JiraAuth` service methods.
- * - `create` opens the Atlassian Developer Console; `configure` prompts for client ID/secret.
+ * `jira auth`: the shared Atlassian auth commands over {@link JiraAuth}.
  *
  * @internal
  */
-import { Argument as Args, Command, Flag as Options, Prompt } from "effect/cli"
-import * as Console from "effect/Console"
-import * as Effect from "effect/Effect"
-import * as Option from "effect/Option"
-import { openBrowser } from "../internal/openBrowser.js"
-import { JiraAuth } from "../JiraAuth.js"
-
-// === Auth create command ===
-const createCommand = Command.make("create", {}, () =>
-  Effect.gen(function*() {
-    yield* Console.log(`
-Creating OAuth app in Atlassian Developer Console...
-
-1. Browser will open to create a new OAuth 2.0 (3LO) app
-2. Enter app name (e.g., "Jira CLI")
-3. After creation, go to "Permissions" and add:
-
-   Jira API:
-   - read:jira-work    Search and read issues, comments, attachments
-   - read:jira-user    Read user info for assignee/reporter fields
-
-   User Identity API:
-   - read:me           Get your account ID and email for auth
-
-4. Go to "Authorization" and set callback URL:
-   http://localhost:8585/callback
-5. Go to "Settings" and copy Client ID and Secret
-6. Run: jira auth configure --client-id <ID> --client-secret <SECRET>
-`)
-    const url = "https://developer.atlassian.com/console/myapps/create-3lo-app/"
-    yield* openBrowser(url).pipe(Effect.catch(() => Effect.void))
-  })).pipe(Command.withDescription("Create OAuth app in Atlassian Developer Console"))
-
-// === Auth configure command ===
-const clientIdOption = Options.String("client-id").pipe(
-  Options.withDescription("OAuth client ID from Atlassian Developer Console"),
-  Options.optional
-)
-const clientSecretOption = Options.String("client-secret").pipe(
-  Options.withDescription("OAuth client secret"),
-  Options.optional
-)
-
-const configureCommand = Command.make(
-  "configure",
-  { clientId: clientIdOption, clientSecret: clientSecretOption },
-  ({ clientId, clientSecret }) =>
-    Effect.gen(function*() {
-      const auth = yield* JiraAuth
-
-      const rawClientId = Option.isSome(clientId)
-        ? clientId.value
-        : yield* Prompt.String({ message: "Enter OAuth client ID:" })
-      const rawClientSecret = Option.isSome(clientSecret)
-        ? clientSecret.value
-        : yield* Prompt.String({ message: "Enter OAuth client secret:" })
-
-      yield* auth.configure({ clientId: rawClientId, clientSecret: rawClientSecret })
-      yield* Console.log("OAuth configured. Run 'jira auth login' to authenticate.")
-    })
-).pipe(Command.withDescription("Configure OAuth client credentials"))
-
-// === Auth login command ===
-const siteOption = Options.String("site").pipe(
-  Options.withDescription("Jira site URL to use (for accounts with multiple sites)"),
-  Options.optional
-)
-
-const loginCommand = Command.make("login", { site: siteOption }, ({ site }) =>
-  Effect.gen(function*() {
-    const auth = yield* JiraAuth
-    const result = yield* auth.login(Option.isSome(site) ? { siteUrl: site.value } : undefined)
-    if (Array.isArray(result) && result.length > 0) {
-      yield* Console.log("\nRe-run with --site to select a specific site.")
-    }
-  })).pipe(Command.withDescription("Authenticate with Atlassian via OAuth"))
-
-// === Auth logout command ===
-const logoutCommand = Command.make("logout", {}, () =>
-  Effect.gen(function*() {
-    const auth = yield* JiraAuth
-    yield* auth.logout()
-    yield* Console.log("Logged out")
-  })).pipe(Command.withDescription("Remove stored authentication"))
-
-// === Auth status command ===
-const statusCommand = Command.make("status", {}, () =>
-  Effect.gen(function*() {
-    const auth = yield* JiraAuth
-    const profile = yield* auth.getActiveProfile()
-    if (profile) {
-      const user = profile.token.user
-      const account = user ? `${user.name} (${user.email})` : "unknown user"
-      yield* Console.log(`Active profile: ${profile.name}`)
-      yield* Console.log(`Account: ${account}`)
-      yield* Console.log(`Site: ${profile.token.site_url}`)
-      yield* Console.log(`Profile ID: ${profile.id}`)
-    } else {
-      yield* Console.log("Not logged in. Use 'jira auth login' to authenticate.")
-    }
-  })).pipe(Command.withDescription("Show authentication status"))
-
-// === Auth profiles command ===
-const profilesCommand = Command.make("profiles", {}, () =>
-  Effect.gen(function*() {
-    const auth = yield* JiraAuth
-    const [profiles, active] = yield* Effect.all([auth.listProfiles(), auth.getActiveProfile()])
-    if (profiles.length === 0) {
-      yield* Console.log("No auth profiles. Use 'jira auth login' to authenticate.")
-      return
-    }
-
-    for (const profile of profiles) {
-      const marker = active?.id === profile.id ? "*" : " "
-      yield* Console.log(`${marker} ${profile.id}`)
-      yield* Console.log(`    ${profile.name}`)
-      yield* Console.log(`    ${profile.token.site_url}`)
-    }
-  })).pipe(Command.withDescription("List stored auth profiles"))
-
-const profileArg = Args.String("profile").pipe(
-  Args.withDescription("Profile ID, name, site URL, cloud ID, or account ID")
-)
-
-// === Auth use command ===
-const useCommand = Command.make("use", { profile: profileArg }, ({ profile }) =>
-  Effect.gen(function*() {
-    const auth = yield* JiraAuth
-    const selected = yield* auth.switchProfile(profile)
-    if (!selected) {
-      yield* Console.log(`Profile not found: ${profile}`)
-      return
-    }
-    yield* Console.log(`Active profile: ${selected.name}`)
-  })).pipe(Command.withDescription("Switch active auth profile"))
-
-// === Auth remove command ===
-const removeCommand = Command.make("remove", { profile: profileArg }, ({ profile }) =>
-  Effect.gen(function*() {
-    const auth = yield* JiraAuth
-    const removed = yield* auth.removeProfile(profile)
-    if (!removed) {
-      yield* Console.log(`Profile not found: ${profile}`)
-      return
-    }
-    yield* Console.log(`Removed profile: ${removed.name}`)
-  })).pipe(Command.withDescription("Remove stored auth profile"))
+import { makeAuthCommand } from "@knpkv/atlassian-common/cli-auth"
+import { JiraAuth, jiraCliDescriptor } from "../JiraAuth.js"
 
-// === Auth command group ===
-export const authCommand = Command.make("auth").pipe(
-  Command.withDescription("Manage OAuth authentication"),
-  Command.withSubcommands([
-    createCommand,
-    configureCommand,
-    loginCommand,
-    logoutCommand,
-    statusCommand,
-    profilesCommand,
-    useCommand,
-    removeCommand
-  ])
-)
+export const authCommand = makeAuthCommand(JiraAuth, jiraCliDescriptor, { apiSection: "Jira API" })

package/test/JiraAuth.test.ts

@@ -0,0 +1,79 @@
+/** @effect-diagnostics strictEffectProvide:skip-file */
+/**
+ * JiraAuth is the shared Atlassian CLI auth bound to Jira. These pin the binding:
+ * the `jira-cli` storage namespace, Jira's own "not logged in" error, the `jira`
+ * command in re-login hints, and a redacted token. The refresh rules themselves
+ * are covered once in `@knpkv/atlassian-common`'s cli-auth tests.
+ */
+import { NodeFileSystem, NodePath, NodeServices } from "@effect/platform-node"
+import { describe, expect, it } from "@effect/vitest"
+import { HomeDirectoryLive, saveOAuthConfig, saveProfileToken } from "@knpkv/atlassian-common/config"
+import { ConfigProvider } from "effect"
+import * as Effect from "effect/Effect"
+import * as FileSystem from "effect/FileSystem"
+import { HttpClient, HttpClientResponse } from "effect/http"
+import * as Layer from "effect/Layer"
+import * as Redacted from "effect/Redacted"
+import { JiraAuth, layer as jiraAuthLayer } from "../src/JiraAuth.js"
+
+const storage = Layer.mergeAll(NodeFileSystem.layer, NodePath.layer, HomeDirectoryLive)
+
+const withHome = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+  Effect.gen(function*() {
+    const fs = yield* FileSystem.FileSystem
+    const home = yield* fs.makeTempDirectoryScoped({ prefix: "jira-auth-" })
+    return yield* effect.pipe(
+      Effect.provide(ConfigProvider.layer(ConfigProvider.fromEnv({ env: { HOME: home } })))
+    )
+  }).pipe(Effect.scoped, Effect.provide(NodeFileSystem.layer))
+
+const rejectingClient = Layer.succeed(
+  HttpClient.HttpClient,
+  HttpClient.make((request) =>
+    Effect.succeed(
+      HttpClientResponse.fromWeb(request, new Response(JSON.stringify({ error: "invalid_grant" }), { status: 400 }))
+    )
+  )
+)
+
+const withAuth = <A, E>(use: (auth: JiraAuth["Service"]) => Effect.Effect<A, E>) =>
+  JiraAuth.pipe(
+    Effect.flatMap(use),
+    Effect.provide(jiraAuthLayer.pipe(Layer.provide(Layer.mergeAll(rejectingClient, NodeServices.layer))))
+  )
+
+const token = (expiresAt: number) => ({
+  access_token: "access-1",
+  refresh_token: "refresh-1",
+  expires_at: expiresAt,
+  token_type: "Bearer",
+  scope: "offline_access",
+  cloud_id: "cloud-1",
+  site_url: "https://example.atlassian.net"
+})
+
+describe("JiraAuth", () => {
+  it.effect("fails with Jira's own error when nobody is logged in", () =>
+    withHome(Effect.gen(function*() {
+      const error = yield* withAuth((auth) => auth.getAccessToken()).pipe(Effect.flip)
+      expect(error).toMatchObject({ _tag: "AuthMissingError", message: "Not logged in. Run 'jira auth login' first." })
+    })))
+
+  it.effect("reads the jira-cli profile and returns a redacted token", () =>
+    withHome(Effect.gen(function*() {
+      yield* saveProfileToken("jira-cli", token(Number.MAX_SAFE_INTEGER)).pipe(Effect.provide(storage))
+      const accessToken = yield* withAuth((auth) => auth.getAccessToken())
+      expect(Redacted.value(accessToken)).toBe("access-1")
+      expect(yield* withAuth((auth) => auth.getSiteUrl())).toBe("https://example.atlassian.net")
+    })))
+
+  it.effect("names the jira command when the stored token is spent", () =>
+    withHome(Effect.gen(function*() {
+      yield* saveOAuthConfig("jira-cli", { clientId: "client-1", clientSecret: "secret-1" }).pipe(
+        Effect.provide(storage)
+      )
+      yield* saveProfileToken("jira-cli", token(0)).pipe(Effect.provide(storage))
+      const error = yield* withAuth((auth) => auth.getAccessToken()).pipe(Effect.flip)
+      expect(error.message).toContain("Please run 'jira auth login'")
+    })))
+})

package/test/authCommand.test.ts

@@ -0,0 +1,54 @@
+/** @effect-diagnostics strictEffectProvide:skip-file */
+/**
+ * `jira auth create` must list every scope `jira auth login` requests: Atlassian rejects an
+ * authorization request naming a scope the app lacks, so a shorter list is a setup that cannot log in.
+ */
+import { NodeServices } from "@effect/platform-node"
+import { expect, it } from "@effect/vitest"
+import { Command } from "effect/cli"
+import * as Console from "effect/Console"
+import * as Effect from "effect/Effect"
+import { FetchHttpClient } from "effect/http"
+import * as Layer from "effect/Layer"
+import { ChildProcessSpawner } from "effect/process"
+import * as Sink from "effect/Sink"
+import * as Stream from "effect/Stream"
+import { authCommand } from "../src/commands/auth.js"
+import { jiraCliDescriptor, layer } from "../src/JiraAuth.js"
+
+const browserOpens = ChildProcessSpawner.make(() =>
+  Effect.succeed(ChildProcessSpawner.makeHandle({
+    all: Stream.empty,
+    exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(0)),
+    getInputFd: () => Sink.drain,
+    getOutputFd: () => Stream.empty,
+    isRunning: Effect.succeed(false),
+    kill: () => Effect.void,
+    pid: ChildProcessSpawner.ProcessId(1),
+    reref: Effect.void,
+    stderr: Stream.empty,
+    stdin: Sink.drain,
+    stdout: Stream.empty,
+    unref: Effect.succeed(Effect.void)
+  }))
+)
+
+it.effect("auth create lists every scope JiraAuth logs in with", () =>
+  Effect.gen(function*() {
+    const lines: Array<string> = []
+    const capture: Console.Console = Object.assign(Object.create(console), {
+      log: (...parts: ReadonlyArray<unknown>) => lines.push(parts.join(" "))
+    })
+    const cli = Command.runWith(Command.make("jira").pipe(Command.withSubcommands([authCommand])), { version: "0" })
+    const exit = yield* cli(["auth", "create"]).pipe(Effect.provideService(Console.Console, capture), Effect.exit)
+    expect(exit._tag).toBe("Success")
+    const output = lines.join("\n")
+    const permissions = jiraCliDescriptor.scopes.filter((scope) => scope !== "offline_access")
+    expect(permissions.length).toBeGreaterThan(2)
+    for (const scope of permissions) expect(output).toContain(scope)
+    expect(output).toContain("jira auth configure")
+  }).pipe(
+    // The command's browser launch sees the fake; the auth layer is built over real platform services.
+    Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, browserOpens),
+    Effect.provide(layer.pipe(Layer.provideMerge(Layer.mergeAll(FetchHttpClient.layer, NodeServices.layer))))
+  ))

package/vitest.config.integration.ts

@@ -3,8 +3,11 @@ import { defineConfig } from "vitest/config"
 export default defineConfig({
   resolve: {
     alias: {
-      "@knpkv/atlassian-common/attachments": new URL("../atlassian-common/src/attachments.ts", import.meta.url).pathname,
+      "@knpkv/atlassian-common/attachments":
+        new URL("../atlassian-common/src/attachments.ts", import.meta.url).pathname,
       "@knpkv/atlassian-common/auth": new URL("../atlassian-common/src/auth/index.ts", import.meta.url).pathname,
+      "@knpkv/atlassian-common/cli-auth":
+        new URL("../atlassian-common/src/cli-auth/index.ts", import.meta.url).pathname,
       "@knpkv/atlassian-common/config": new URL("../atlassian-common/src/config/index.ts", import.meta.url).pathname,
       "@knpkv/agent-skills": new URL("../agent-skills/src/index.ts", import.meta.url).pathname,
       "@knpkv/jira-api-client": new URL("../jira-api-client/src/index.ts", import.meta.url).pathname

package/vitest.config.ts

@@ -3,8 +3,11 @@ import { defineConfig } from "vitest/config"
 export default defineConfig({
   resolve: {
     alias: {
-      "@knpkv/atlassian-common/attachments": new URL("../atlassian-common/src/attachments.ts", import.meta.url).pathname,
+      "@knpkv/atlassian-common/attachments":
+        new URL("../atlassian-common/src/attachments.ts", import.meta.url).pathname,
       "@knpkv/atlassian-common/auth": new URL("../atlassian-common/src/auth/index.ts", import.meta.url).pathname,
+      "@knpkv/atlassian-common/cli-auth":
+        new URL("../atlassian-common/src/cli-auth/index.ts", import.meta.url).pathname,
       "@knpkv/atlassian-common/config": new URL("../atlassian-common/src/config/index.ts", import.meta.url).pathname,
       "@knpkv/agent-skills": new URL("../agent-skills/src/index.ts", import.meta.url).pathname,
       "@knpkv/jira-api-client": new URL("../jira-api-client/src/index.ts", import.meta.url).pathname

package/dist/internal/NodeLayers.d.ts

@@ -1,7 +0,0 @@
-/**
- * HTTP Server factory layer using Node.js http module.
- *
- * @category Layers
- */
-export declare const HttpServerFactoryLive: import("effect/Layer").Layer<import("./oauthServer.js").HttpServerFactoryTag, never, never>;
-//# sourceMappingURL=NodeLayers.d.ts.map

package/dist/internal/NodeLayers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"NodeLayers.d.ts","sourceRoot":"","sources":["../../src/internal/NodeLayers.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,6FAEjC,CAAA"}

package/dist/internal/NodeLayers.js

@@ -1,15 +0,0 @@
-/**
- * Node.js-specific HTTP server factory — the only file importing `@effect/platform-node` server.
- *
- * @internal
- */
-import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
-import { createServer } from "node:http";
-import { makeHttpServerFactory } from "./oauthServer.js";
-/**
- * HTTP Server factory layer using Node.js http module.
- *
- * @category Layers
- */
-export const HttpServerFactoryLive = makeHttpServerFactory((options) => NodeHttpServer.layerServer(createServer, options));
-//# sourceMappingURL=NodeLayers.js.map

package/dist/internal/NodeLayers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"NodeLayers.js","sourceRoot":"","sources":["../../src/internal/NodeLayers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,cAAc,MAAM,sCAAsC,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CACxD,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAC/D,CAAA"}

package/dist/internal/oauthServer.d.ts

@@ -1,72 +0,0 @@
-/**
- * Local HTTP callback server for OAuth2 authorization code capture.
- *
- * **Mental model**
- *
- * - **Scope-owned lifecycle**: {@link startCallbackServer} returns a `codePromise`
- *   (Deferred). The server validates the CSRF `state` parameter, resolves the
- *   Deferred with the authorization code, and stops when its enclosing scope closes.
- * - **Port auto-discovery**: Tries default port 8585, increments on conflict.
- *
- * @internal
- */
-import { OAuthError } from "@knpkv/atlassian-common/auth";
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import { HttpServer } from "effect/http";
-import type * as HttpServerError from "effect/http/HttpServerError";
-import * as Layer from "effect/Layer";
-import type * as Scope from "effect/Scope";
-/**
- * Factory service for creating HTTP servers.
- * This allows mocking the server creation in tests.
- *
- * @category Services
- */
-export interface HttpServerFactory {
-    readonly createServerLayer: (options: CallbackServerListenOptions) => Layer.Layer<HttpServer.HttpServer, HttpServerError.ServeError, never>;
-}
-export interface CallbackServerListenOptions {
-    readonly host: "localhost";
-    readonly port: number;
-}
-export declare const callbackServerListenOptions: (port: number) => CallbackServerListenOptions;
-export declare const callbackUrl: (port: number) => string;
-declare const HttpServerFactoryTag_base: Context.ServiceClass<HttpServerFactoryTag, "@knpkv/jira-cli/HttpServerFactory", HttpServerFactory>;
-/**
- * Tag for the HttpServerFactory service.
- *
- * @category Services
- */
-export declare class HttpServerFactoryTag extends HttpServerFactoryTag_base {
-}
-/**
- * Create a HttpServerFactory layer from a layer factory function.
- * This allows injecting platform-specific implementations.
- *
- * @param createLayerFn - Function that creates HttpServer layer for a given port
- * @returns Layer providing HttpServerFactory
- *
- * @category Layers
- */
-export declare const makeHttpServerFactory: (createLayerFn: (options: CallbackServerListenOptions) => Layer.Layer<HttpServer.HttpServer, HttpServerError.ServeError, never>) => Layer.Layer<HttpServerFactoryTag>;
-/**
- * Result from the OAuth callback server.
- */
-export interface CallbackServerResult {
-    /** Promise that resolves with the authorization code */
-    readonly codePromise: Effect.Effect<string, OAuthError>;
-    /** The port the server is listening on */
-    readonly port: number;
-}
-/**
- * Start a local HTTP server to receive OAuth callback.
- *
- * @param expectedState - The state parameter to verify against CSRF
- * @returns Server control interface with code promise and port
- *
- * @category OAuth
- */
-export declare const startCallbackServer: (expectedState: string) => Effect.Effect<CallbackServerResult, OAuthError, HttpServerFactoryTag | Scope.Scope>;
-export {};
-//# sourceMappingURL=oauthServer.d.ts.map

package/dist/internal/oauthServer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauthServer.d.ts","sourceRoot":"","sources":["../../src/internal/oauthServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AAEzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAc,UAAU,EAAsB,MAAM,aAAa,CAAA;AACxE,OAAO,KAAK,KAAK,eAAe,MAAM,6BAA6B,CAAA;AACnE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAGrC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAA;AAK1C;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,KAAK,CAAC,KAAK,CAC/E,UAAU,CAAC,UAAU,EACrB,eAAe,CAAC,UAAU,EAC1B,KAAK,CACN,CAAA;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,eAAO,MAAM,2BAA2B,SAAU,MAAM,KAAG,2BAGzD,CAAA;AAEF,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAA6C,CAAA;;AAExF;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,yBAGF;CAAG;AAE3C;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,kBACjB,CACb,OAAO,EAAE,2BAA2B,KACjC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,KACzE,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAG/B,CAAA;AAEJ;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACvD,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAQD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,kBACf,MAAM,KACpB,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,UAAU,EAAE,oBAAoB,GAAG,KAAK,CAAC,KAAK,CAgFjF,CAAA"}

package/dist/internal/oauthServer.js

@@ -1,97 +0,0 @@
-/**
- * Local HTTP callback server for OAuth2 authorization code capture.
- *
- * **Mental model**
- *
- * - **Scope-owned lifecycle**: {@link startCallbackServer} returns a `codePromise`
- *   (Deferred). The server validates the CSRF `state` parameter, resolves the
- *   Deferred with the authorization code, and stops when its enclosing scope closes.
- * - **Port auto-discovery**: Tries default port 8585, increments on conflict.
- *
- * @internal
- */
-import { OAuthError } from "@knpkv/atlassian-common/auth";
-import * as Context from "effect/Context";
-import * as Deferred from "effect/Deferred";
-import * as Effect from "effect/Effect";
-import { HttpRouter, HttpServer, HttpServerResponse } from "effect/http";
-import * as Layer from "effect/Layer";
-import { NetAddress } from "effect/net";
-import * as Schema from "effect/Schema";
-const DEFAULT_PORT = 8585;
-const MAX_PORT = 8594;
-export const callbackServerListenOptions = (port) => ({
-    host: "localhost",
-    port
-});
-export const callbackUrl = (port) => `http://localhost:${port}/callback`;
-/**
- * Tag for the HttpServerFactory service.
- *
- * @category Services
- */
-export class HttpServerFactoryTag extends Context.Service()("@knpkv/jira-cli/HttpServerFactory") {
-}
-/**
- * Create a HttpServerFactory layer from a layer factory function.
- * This allows injecting platform-specific implementations.
- *
- * @param createLayerFn - Function that creates HttpServer layer for a given port
- * @returns Layer providing HttpServerFactory
- *
- * @category Layers
- */
-export const makeHttpServerFactory = (createLayerFn) => Layer.succeed(HttpServerFactoryTag, {
-    createServerLayer: createLayerFn
-});
-const AddressInUseCause = Schema.Struct({
-    code: Schema.Literal("EADDRINUSE")
-});
-const isAddressInUse = (error) => Schema.is(AddressInUseCause)(error.cause);
-/**
- * Start a local HTTP server to receive OAuth callback.
- *
- * @param expectedState - The state parameter to verify against CSRF
- * @returns Server control interface with code promise and port
- *
- * @category OAuth
- */
-export const startCallbackServer = (expectedState) => Effect.gen(function* () {
-    const factory = yield* HttpServerFactoryTag;
-    const deferred = yield* Deferred.make();
-    const serverScope = yield* Effect.scope;
-    const buildServerContext = (port) => Layer.buildWithScope(factory.createServerLayer(callbackServerListenOptions(port)), serverScope).pipe(Effect.map((context) => ({ context, port })), Effect.catchIf((error) => isAddressInUse(error) && port < MAX_PORT, () => buildServerContext(port + 1)), Effect.mapError((cause) => new OAuthError({ step: "authorize", cause })));
-    const { context: serverContext } = yield* buildServerContext(DEFAULT_PORT);
-    const server = Context.get(serverContext, HttpServer.HttpServer);
-    const port = yield* (NetAddress.isInetAddress(server.address)
-        ? Effect.succeed(server.address.port)
-        : Effect.fail(new OAuthError({ step: "authorize", cause: "OAuth callback server must listen on a TCP port" })));
-    const router = yield* HttpRouter.make;
-    yield* router.add("GET", "/callback", (req) => Effect.gen(function* () {
-        const url = new URL(req.url, callbackUrl(port));
-        const code = url.searchParams.get("code");
-        const state = url.searchParams.get("state");
-        const error = url.searchParams.get("error");
-        const errorDescription = url.searchParams.get("error_description");
-        if (state !== expectedState) {
-            return HttpServerResponse.html("<html><body><h1>Security Error</h1><p>State verification failed.</p></body></html>").pipe(HttpServerResponse.setStatus(403));
-        }
-        if (error) {
-            yield* Deferred.fail(deferred, new OAuthError({ step: "authorize", cause: errorDescription ?? error }));
-            return HttpServerResponse.html("<html><body><h1>Authorization Failed</h1><p>You can close this window.</p></body></html>");
-        }
-        if (!code) {
-            yield* Deferred.fail(deferred, new OAuthError({ step: "authorize", cause: "No authorization code received" }));
-            return HttpServerResponse.html("<html><body><h1>Error</h1><p>No authorization code received.</p></body></html>");
-        }
-        yield* Deferred.succeed(deferred, code);
-        return HttpServerResponse.html("<html><body><h1>Success!</h1><p>You can close this window and return to the terminal.</p></body></html>");
-    }));
-    const app = router.asHttpEffect();
-    yield* HttpServer.serveEffect(app).pipe(Effect.provide(serverContext), Effect.forkScoped);
-    return {
-        codePromise: Deferred.await(deferred),
-        port
-    };
-});
-//# sourceMappingURL=oauthServer.js.map

package/dist/internal/oauthServer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauthServer.js","sourceRoot":"","sources":["../../src/internal/oauthServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAA;AACzC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAExE,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,MAAM,YAAY,GAAG,IAAI,CAAA;AACzB,MAAM,QAAQ,GAAG,IAAI,CAAA;AAqBrB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,IAAY,EAA+B,EAAE,CAAC,CAAC;IACzF,IAAI,EAAE,WAAW;IACjB,IAAI;CACL,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,oBAAoB,IAAI,WAAW,CAAA;AAExF;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,OAAO,CAAC,OAAO,EAGtD,CAAC,mCAAmC,CAAC;CAAG;AAE3C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,aAE0E,EACvC,EAAE,CACrC,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE;IAClC,iBAAiB,EAAE,aAAa;CACjC,CAAC,CAAA;AAYJ,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;CACnC,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,KAAiC,EAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AAEhH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,aAAqB,EACgE,EAAE,CACvF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,oBAAoB,CAAA;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAsB,CAAA;IAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAA;IACvC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAGtC,EAAE,CACF,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAClG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAC5C,MAAM,CAAC,OAAO,CACZ,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,QAAQ,EACnD,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC,CACnC,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CACzE,CAAA;IACH,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAuB,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;IACpF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3D,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAC,CAAC,CAAA;IAEjH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAA;IACrC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACf,KAAK,EACL,WAAW,EACX,CAAC,GAAG,EAAE,EAAE,CACN,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QAElE,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,OAAO,kBAAkB,CAAC,IAAI,CAC5B,oFAAoF,CACrF,CAAC,IAAI,CACJ,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAClC,CAAA;QACH,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAClB,QAAQ,EACR,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,IAAI,KAAK,EAAE,CAAC,CACxE,CAAA;YACD,OAAO,kBAAkB,CAAC,IAAI,CAC5B,0FAA0F,CAC3F,CAAA;QACH,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAClB,QAAQ,EACR,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAC/E,CAAA;YACD,OAAO,kBAAkB,CAAC,IAAI,CAC5B,gFAAgF,CACjF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACvC,OAAO,kBAAkB,CAAC,IAAI,CAC5B,yGAAyG,CAC1G,CAAA;IACH,CAAC,CAAC,CACL,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,EAAE,CAAA;IAEjC,KAAK,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CACrC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAC7B,MAAM,CAAC,UAAU,CAClB,CAAA;IAED,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QACrC,IAAI;KACL,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/internal/openBrowser.d.ts

@@ -1,10 +0,0 @@
-/**
- * Cross-platform browser launcher backed by Effect v4 child process services.
- *
- * @internal
- */
-import * as Effect from "effect/Effect";
-import type * as PlatformError from "effect/PlatformError";
-import { ChildProcessSpawner } from "effect/process";
-export declare const openBrowser: (url: string) => Effect.Effect<void, PlatformError.PlatformError, ChildProcessSpawner.ChildProcessSpawner>;
-//# sourceMappingURL=openBrowser.d.ts.map

package/dist/internal/openBrowser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"openBrowser.d.ts","sourceRoot":"","sources":["../../src/internal/openBrowser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,aAAa,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAgB,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAiBlE,eAAO,MAAM,WAAW,QACjB,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,aAAa,EAAE,mBAAmB,CAAC,mBAAmB,CAIxF,CAAA"}

package/dist/internal/openBrowser.js

@@ -1,17 +0,0 @@
-/**
- * Cross-platform browser launcher backed by Effect v4 child process services.
- *
- * @internal
- */
-import * as Effect from "effect/Effect";
-import { ChildProcess, ChildProcessSpawner } from "effect/process";
-const run = (command, args) => Effect.gen(function* () {
-    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-    yield* spawner.exitCode(ChildProcess.make(command, args, {
-        stdin: "ignore",
-        stdout: "ignore",
-        stderr: "ignore"
-    }));
-});
-export const openBrowser = (url) => run("open", [url]).pipe(Effect.catch(() => run("xdg-open", [url])), Effect.catch(() => run("rundll32.exe", ["url.dll,FileProtocolHandler", url])));
-//# sourceMappingURL=openBrowser.js.map

package/dist/internal/openBrowser.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"openBrowser.js","sourceRoot":"","sources":["../../src/internal/openBrowser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAElE,MAAM,GAAG,GAAG,CACV,OAAe,EACf,IAA2B,EACgE,EAAE,CAC7F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAC,mBAAmB,CAAA;IAC9D,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CACrB,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE;QAC/B,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;KACjB,CAAC,CACH,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,GAAW,EACgF,EAAE,CAC7F,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CACrB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC,CAC9E,CAAA"}

package/src/internal/NodeLayers.ts

@@ -1,17 +0,0 @@
-/**
- * Node.js-specific HTTP server factory — the only file importing `@effect/platform-node` server.
- *
- * @internal
- */
-import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer"
-import { createServer } from "node:http"
-import { makeHttpServerFactory } from "./oauthServer.js"
-
-/**
- * HTTP Server factory layer using Node.js http module.
- *
- * @category Layers
- */
-export const HttpServerFactoryLive = makeHttpServerFactory(
-  (options) => NodeHttpServer.layerServer(createServer, options)
-)